Skip to content
Get packs

Guide · Agent skill

How to use the OneCLI gateway installer agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The add-onecli skill is an installer for NanoClaw, a setup that runs AI agents in containers. It installs OneCLI, a gateway that sits between those agents and the outside services they call, so model API keys and logins stay out of the agent containers. This guide explains what the skill does, how to add it to Claude, how to ask for it, and what to check before running it.

OneCLI gateway installernanocoai/nanoclaw · MIT

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or the project's .claude/skills/ folder.
  2. 2Check the requirements. Confirm Node.js with pnpm and tsx is installed and that the NanoClaw project has the gateway provider seam.
  3. 3Ask for the setup in plain words. Tell the agent you want OneCLI as your NanoClaw gateway, or that you want an existing install moved to the gateway seam.
  4. 4Run the setup script. Let the agent run pnpm exec tsx .claude/skills/add-onecli/scripts/setup.ts, which reuses, installs or connects to the gateway.
  5. 5Check any reused gateway. Because setup does not check a reused gateway's version, follow the upgrade guide in docs to verify it.
  6. 6Complete Claude authentication. Finish Claude authentication through scripts/auth.ts. Credentials stay in the gateway and out of agent containers.
  7. 7Grant secrets and verify. Attach any extra secrets to chosen agent groups with the grants commands, then list grants to confirm.

What is an agent skill and what does add-onecli do?

An agent skill is a folder with a SKILL.md file and any scripts it needs. You add it to Claude, and when a request matches the skill's description, Claude follows the instructions in that folder. The add-onecli skill is written for NanoClaw projects.

Once installed, the skill sets up OneCLI as NanoClaw's gateway provider. After that, requests from the agent to model providers go through OneCLI, which injects the credentials and handles approval prompts. The skill also copies adapter code, tests and agent guidance into the NanoClaw project, and records which model credentials belong to which agent group.

  • Keeps model API keys and model logins out of agent containers
  • Routes agent requests to model providers through the OneCLI gateway
  • Copies provider code, tests and agent guidance into the NanoClaw project
  • Records which saved model credential belongs to which agent group

Install the add-onecli skill

You can add the skill in one of two ways. Download the ZIP from this page and unzip it into ~/.claude/skills/ for all your projects, or into a project's .claude/skills/ folder for that project only.

To use it in the Claude apps instead, upload the ZIP under Settings, then Capabilities, then Skills.

  • Personal: unzip into ~/.claude/skills/
  • Single project: unzip into the project's .claude/skills/ folder
  • Claude apps: Settings, Capabilities, Skills, then upload the ZIP

Check the requirements before you run it

The skill expects a NanoClaw project that already has the gateway provider seam. It also needs Node.js with pnpm and tsx, since the setup runs with pnpm exec tsx.

The pinned OneCLI gateway version, the onecli-cli version and the SDK version are all listed in the skill's files. Check them there rather than relying on older guides. Model provider credentials, such as a Claude key, are stored through the gateway. A remote gateway is optional and needs its host and a token.

The skill runs scripts and uses the network, so read the steps before running it.

  • NanoClaw project with the gateway provider seam
  • Node.js with pnpm and tsx
  • OneCLI gateway at the version pinned in .claude/skills/add-onecli/versions.json
  • onecli-cli 2.9 or later, for the agents grants command
  • Optional: a remote gateway host and NANOCLAW_ONECLI_API_TOKEN
  • Model provider credentials stored through the gateway

Run the setup and ask for it in plain language

Ask the agent in plain words, for example that you want OneCLI as your NanoClaw gateway, or that you want to move an existing OneCLI-backed install to the gateway seam. The skill's description covers setup selecting OneCLI, migrating an existing install, and restoring its runtime, approval bridge, setup or agent guidance.

The setup script reuses a healthy existing gateway, installs the pinned local gateway if none exists, or uses NANOCLAW_ONECLI_API_HOST and NANOCLAW_ONECLI_API_TOKEN for a remote gateway. Setup does not check the version of a gateway it reuses, so check that yourself using the upgrade guide in the project's docs folder.

After the setup steps succeed, Claude authentication is completed through scripts/auth.ts. Credentials never enter an agent container.

pnpm exec tsx .claude/skills/add-onecli/scripts/setup.ts

Grant secrets to specific agent groups

Model credentials that a provider skill saves are attached to the agent group that runs that provider. Every other secret and app connection is opt-in, so new groups do not receive it. To grant one by hand, attach it to the agent with the command below. The gateway can take up to a minute to apply a change.

Do not put a key in .env, in command arguments or in the container environment.

  • List agents and map group ids: onecli agents list --max 0
  • Attach a secret: onecli agents grants attach-secret --id agent-id --secret-id secret-id
  • Verify grants: onecli agents grants list --id agent-id
  • Detach a secret with detach-secret
onecli agents grants attach-secret --id <agent-id> --secret-id <secret-id>

Validate and troubleshoot the install

Run the build and the test suite that the skill lists. The setup sets NANOCLAW_GATEWAY_PROVIDER=onecli only after every step above succeeds, so a failed run should not leave the gateway selected.

If you have an older implicit OneCLI install, the upgrade script detects it during an atomic NanoClaw upgrade so the updater keeps that choice before the service restarts. For ChatGPT logins, unattended token refresh is not yet verified on the pinned gateway, so you need to reauthenticate manually.

  • Run pnpm run build, then the vitest command listed in the skill
  • Use the upgrade guide to check and move a reused gateway to the pin
  • For ChatGPT, follow the manual reauthentication path in the skill's references
pnpm run build

What people use it for

  • Run NanoClaw agents while keeping a Claude key out of their containers
  • Move an existing OneCLI-backed NanoClaw install onto the newer gateway seam
  • Point NanoClaw at a remote OneCLI gateway using an API host and token
  • Give one agent group a model credential, such as one saved by a provider skill, without giving it to every group

Frequently asked questions

Is the add-onecli skill free to use?

The skill is published under the MIT licence. The source does not state the licence terms for OneCLI itself, so check OneCLI's own documentation before you rely on it.

What do I need before installing add-onecli?

You need a NanoClaw project with the gateway provider seam, Node.js with pnpm and tsx, and onecli-cli for the grants commands. The gateway version is pinned in the skill's versions.json file, and model provider credentials are stored through the gateway.

Does add-onecli work with OneCLI 2.x?

No. The skill states that OneCLI 2.x is not supported and that the integration supports only the gateway version pinned in versions.json. Use that pinned gateway version.

Why does my OneCLI setup fail or behave oddly?

Setup reuses an existing gateway without checking its version, so an old gateway can cause problems. Use the upgrade guide in the project's docs folder to check the gateway and move it to the pinned version. Then run the build and the listed tests again.

Can I use ChatGPT logins with add-onecli unattended?

Not yet. The source says unattended ChatGPT token refresh is not verified on the pinned gateway, so you must reauthenticate manually through the path in the skill's references.

Should I use add-onecli or plain NanoClaw without a gateway?

Use add-onecli if you want model credentials kept out of agent containers and can handle the extra setup steps. If you only want a simple chat assistant with no gateway, the skill adds infrastructure you do not need and can break an install, so skip it.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Pick add-onecli if you run NanoClaw and want model credentials kept out of agent containers, or if you are moving an existing OneCLI-backed install to the gateway seam. Skip it if you only want a simple assistant with no gateway, or if you use OneCLI 2.x or unattended ChatGPT logins, which the skill does not support.

Download the skill